Developing metrics for hidden forms of victimisation

Though CMCs provide an immediate and obvious source of data for criminological research, there are a number of other sources that may be employed to better understand hidden forms of cybercrime. For instance, computer hacking can be examined from a fee-for-service basis when examined using forum data from underground markets. The findings limit our knowledge of the extent of victimisation, and the utility of the attacks in action. The same can be said for malicious software attacks, which are difficult to assess though traditional survey metrics as the symptoms of infection may go unrecognised by the end user (Holt & Bossier, 2016; Mahnon, Kamerdze, Cukier, & Sobesto, 2013).

Enterprising researchers have found ways to assemble data sets that combine existing data sets and strategies to better understand the practices of offenders and victim targets generally. For instance, Kigerl (2013) utilised a series of data sotuces to triangulate the rate of piracy at the country level, combining statistics on software piracy from 1) the Business Software Alliance, 2) an analysis of the total number of active IP addresses associated with a file sharing service geolocated to a country, and 3) the number of downloads per country for four common file sharing software programs. These data provide alternative metrics to assess potential levels of file sharing and illegal downloading and served as the dependent variable to assess the macro-level economic factors affecting piracy as measured by the International Monetary Fund, the CIA World Fact Book, and the Global Competitiveness report. These measures were included in various regression models and Kigerl (2013) fotmd that smaller, poorer countries with less technological resotu ces had higher rates of piracy but lower piracy activity overall across all measures.

Additionally, criminologists have recently begim to use data from honeypots and Intrusion Prevention Systems (IPS) as a tool to understand the practices of computer hackers and assess the utility of deterrence theory and other frameworks to examine computer attacks. Honeypots serve as a trap tool to entice attackers and then monitor then behaviours though log file analyses (Spitzner, 2002), while IPS technologies are installed on computer networks in order to monitor network traffic, send alerts to a management server when a threat is detected, and collect information on attacks and anomalous traffic, such as its source (IP address) and level of severity (see Mahnon et al., 2013 for discussion). The traffic logged by both tools is typically used by computer scientists and cybersecurity practitioners to analyse attacks and attacker behaviour, though there may be benefits to their use for criminological inquiry.

Honeypot data has gamed particular attention among criminologists as they provide an opportunity to not only surreptitiously observe attacker behaviour, but also interact with intruders though various mechanisms (Jang, Kim, Song, & Park, 2013; Nasir & Al-Mousa, 2013). For example, Mannon, Alper, Sobesto. and Cukier (2014) used data from research honeypots at one major American university to test the effectiveness of warning banners as a potential deterrent to reduce the frequency and length of computer intrusions. The researchers deployed 80

Using big data to understand cybercrime 95 honeypots on a university network and assigned each attacker to either a control group or treatment group which received a warning banner message. The warning indicated that unauthorised access was prohibited and subject to criminal and civil penalties under US laws, and that the system is being monitored and may lead to law enforcement contact.

The authors then analysed and compared the behaviours of the treatment and control group and found that 40 percent of the incidents that generated a warning banner were terminated immediately compared to only 25 percent of those incidents that did not receive a warning. This difference was not statistically significant, and banners appeared to have no impact on the frequency of repeat trespassing incidents but reduced the overall duration of the act. Thus, there may be partial utility in configuring systems to warn intruders as to then behaviours, though further study is needed to validate these claims (e.g.. Holt, 2017; Maimon et al., 2013; Maimon, Wilson, Ren, & Berenblum, 2015).

The ability to implement honeypots anywhere in the globe and combine their results in a single data file presents an interesting opportunity for big data analyses of cybercrime threats (e.g., Spitzner, 2002; Maimon et al., 2015). Honeypots also have substantial limitations that directly impact their utility for social science analyses, as attacker behaviours will be unique to the environment of each honeypot limiting their generalisability across states and nations (e.g.. Holt, 2017; Maimon et al., 2015). Researchers are also typically unable to distinguish the motivations of actors within any honeypot, rendering it difficult to extrapolate offenders' decision-making calculus and the factors that shape their behaviour within the environment. Thus, any use of honeypots by researchers, whether using single pots or big data collection and analysis strategies, must be careful to extend the utility or generalisability of then findings beyond their basic operational frameworks.